@opengeni/api-router 2.5.0 → 2.6.4

package/dist/app.js

@@ -23,7 +23,7 @@ import {
   withDefaultEnabledCapabilityMcpTools,
   workflowIdForSession,
   workspaceActorContextExempt
-} from "./chunk-QESX7HDK.js";
+} from "./chunk-XTLI3CBH.js";
 export {
   API_MAX_REQUEST_BODY_BYTES,
   allowedCorsOrigin,

package/dist/auth/managed-auth-attempt-context.d.ts

@@ -1,4 +1,8 @@
-export declare function runManagedAuthAttempt<T>(transactionId: string, action: () => T): T;
+export declare function runManagedAuthAttempt<T>(transactionId: string, providerId: "credential" | "google" | "github", action: () => T): T;
+export declare function runManagedAuthProvider<T>(providerId: "credential" | "google" | "github", action: () => T): T;
 export declare function runManagedAuthDiscardedProviderSession<T>(action: () => T): T;
 export declare function currentManagedAuthAttemptId(): string | null;
+export declare function currentManagedAuthProviderId(): "credential" | "google" | "github";
+export declare function recordCurrentManagedAuthSession(authSessionId: string): void;
+export declare function currentManagedAuthCreatedSessionId(): string | null;
 export declare function shouldDiscardCurrentManagedAuthProviderSession(): boolean;

package/dist/auth/managed-auth.d.ts

@@ -1,4 +1,4 @@
-import type { Settings } from "@opengeni/config";
+import { type Settings } from "@opengeni/config";
 import { type ManagedAuth, type ManagedEmailMessage, type ManagedEmailTransport } from "@opengeni/core";
 import type { Database } from "@opengeni/db";
 export type { ManagedAuth };
@@ -8,7 +8,30 @@ export declare function managedAuthUserCreateOverride(settings: Pick<Settings, "
 } & Record<string, unknown>): {
     data: typeof user;
 } | undefined;
+export declare function managedAuthUserCreateAdmission(settings: Pick<Settings, "environment">, user: {
+    emailVerified: boolean;
+} & Record<string, unknown>, providerId: string): {
+    data: typeof user;
+} | false | undefined;
 /** Keep Better Auth password policy and storage format behind this boundary. */
 export declare function hashManagedAuthPassword(password: string): Promise<string>;
 export declare function createManagedAuth(settings: Settings, db: Database, managedEmailTransport: ManagedEmailTransport): ManagedAuth | null;
+export type ManagedAuthOAuthAttempt = {
+    transactionId: string;
+    provider: "google" | "github";
+    authorityHash: string;
+    transactionSecretHash: string;
+    expectedGeneration: string;
+    expectedActorEpoch: string;
+};
+/**
+ * Resolve OpenGeni's server-only login transaction proof from Better Auth's
+ * database-backed OAuth state before the provider callback consumes it.
+ */
+export declare function resolveManagedAuthOAuthAttempt(auth: ManagedAuth, request: Request, provider: "google" | "github", publicBaseUrl: string): Promise<ManagedAuthOAuthAttempt | null>;
+export declare function isolatedManagedAuthOAuthCallbackRequest(auth: ManagedAuth, request: Request): Promise<{
+    request: Request;
+    stateCookieName: string;
+}>;
+export declare function managedAuthOAuthReturnMatches(raw: string, expectedOrigin: string, transactionId: string, outcome: "complete" | "error"): boolean;
 export declare function sendManagedAuthEmail(transport: ManagedEmailTransport, input: Omit<ManagedEmailMessage, "from">): Promise<void>;